Privacy Information for Applicants

Information on data protection regarding the processing of applicant data in accordance with Art. 13 GDPR

Status: April 2023

Dear Applicants:

Thank you for your interest in our company. In accordance with the requirements of Article 13 of the General Data Protection Regulation (GDPR), we hereby inform you about the processing of personal data provided by you as part of the application process and, if applicable, collected by us, and your rights in this regard. To ensure that you are fully informed about the processing of your personal data as part of the application process, please take note of the following information.

1. Name and contact details of the responsible person

Responsible for the processing of your personal data in the context of the present contact is:

for Dortmund and Heilbronn sites:

Name                      ProtaGene GmbH
Address                   Inselwiesenstraße 10, 74076 Heilbronn, Germany
Phone number         + 49 (0) 7131 74504-0
E-mail address

for Heidelberg site:

Name                      ProtaGene CGT GmbH
Address                   Im Neuenheimer Feld 582, 69120 Heidelberg, Germany
Phone number         + 49 (0) 6221 427 90-0
E-mail address

2. Contact details of the data protection officer

The designated data protection officer for the Dortmund and Heilbronn sites is

DataCo Ltd.
Dachauer Str. 65
80335 Munich
Phone: +49 (0) 89 7400 458 40

The designated data protection officer for the Heidelberg site is

SüdWest Data Protection Rechtsanwaltsgesellschaft mbH
Ludwig-Erhard-Allee 10
76131 Karlsruhe
Phone: +49 (0) 721 5099 87 69

3. Categories of personal data

As part of the application process, we only process data that is related to your application. This may include the following personal data about you.

Application via the applicant portal or sending documents by mail, e-mail:

  • Identifiers (e.g. title, first and last name, date of birth)
  • Address data (e.g. street, house number, postal code, city, country)
  • Contact details (e.g. mobile phone number, e-mail address)
  • Knowledge (e.g. language skills, additional knowledge)
  • Application or profile data (e.g. cover letter, resume, references, earliest start date, desired job, desired locations, salary expectations, how you became aware of us)
  • If applicable, details of contact persons for a reference
  • Information on current salary or remuneration, if applicable
  • Data on areas of interest, if applicable
  • If applicable, link to professional networks, such as XING or LinkedIn profile, and information from such profiles
  • Bank details for travel expenses, if applicable
  • Portrait picture if necessary
  • Presence of your consent to be included in the applicant and/or talent pool.
  • Your consent to contact references named by you and, if applicable, data from correspondence with these references

When accessing and using the applicant portal:

  • IP address
  • Information about the browser type and its version
  • the operating system of the terminal device
  • Your Internet service provider
  • Date and time of access
  • Websites that are accessed by you via our website, cookie data (e.g. pseudonymous cookie ID, length of stay on our applicant portal, page views, movement via links)
  • Content shared by you, if applicable

We process personal data that we receive from you by mail or e-mail in the course of contacting you or your application.

4. Purposes of the processing and its legal basis

Your personal data will be processed for the following purposes:

Purpose Legal basis
Decision on the establishment of an employment relationship with us Art. 88 GDPR in conjunction with Sec. 26 (1) in. V. m. Para. 8 S. 2 BDSG
Implementation of pre-contractual measures Art. 6 para. 1 lit. b GDPR
Inclusion in the applicant pool, provided we have your consent. Art. 6 para. 1 p. 1 lit. a GDPR
assertion, exercise or defense of legal claims. Art. 6 para. 1 p. 1 lit. f GDPR, Art. 9 para. 2 lit. f GDPR
Insofar as special categories of personal data are processed that you have obviously made public Art. 9 para. 2 lit. e GDPR

For the processing of your application and the selection of our employees, we do not collect sensitive data (so-called special categories of personal data relating to racial or ethnic origin, physical or mental health or condition, trade union membership, crimes committed or alleged to have been committed and related legal actions). We ask that you do not submit such data to us with your application. If you do, we will understand this as consent to process this data as part of the application process. The data will not be considered in the selection process.

If you do not provide us with the personal data we need to select personnel, establish an employment relationship or fulfill our obligations as an employer, we may not be able to consider your application or fulfill our obligations as a possible future employer.

5. Recipients or categories of recipients of the personal data

In the course of processing your personal data, we may disclose the personal data concerning you to the following recipients:

  • Within our company, exclusively to the areas and persons who require this data to fulfill contractual and legal obligations or to implement our legitimate interest
  • External employees / freelancers
  • Third party processors/service providers
  • Affiliated companies

Your personal data is processed on our behalf on the basis of order processing contracts pursuant to Art. 28 GDPR. In these cases, we ensure that the processing of personal data is carried out in accordance with the provisions of the GDPR.

Otherwise, data will only be passed on to recipients outside the company if this is permitted or required by law, if the transfer is necessary to fulfill legal obligations, or if we have your consent.

6. Transfer of personal data to a third country

In principle, the personal data collected and generated during the provision of relevant products and services is stored on our servers in the European Union. Since the providers of our software solutions, among others, offer their products and/or services on a global basis based on available resources and servers, your personal data may be transferred to or accessed from other jurisdictions outside the European Union and the European Economic Area. In particular, personal data will be transferred to the third country USA within the meaning of Article 15 (2) of the GDPR. In order to ensure the continuation of the necessary level of protection in the event of data transfer to a third country, contractual measures are agreed for this purpose. The software provider has its registered office in the Netherlands. In order to ensure appropriate guarantees for the protection of the transfer and processing of personal data outside the EU, the transfer of data to and processing of data by our service providers is carried out on the basis of appropriate guarantees pursuant to Art. 46 ff GDPR, in particular by concluding so-called standard data protection clauses pursuant to Art. 46 para. 2 lit. c GDPR.

7. Duration of the storage of the personal data

We store your personal data for as long as is necessary to make a decision about your application.

Insofar as an employment relationship between you and us is not established, your personal data will be deleted from the system no later than six months after the termination of the process.

Insofar as an employment relationship arises between you and us, we may, in accordance with Section 26 (1) of the German Federal Data Protection Act (BDSG), further process the personal data already received from you for the purposes of the employment relationship if this is necessary for the performance or termination of the employment relationship or for the exercise or fulfillment of the rights and obligations of the employee representative body resulting from a law or a collective agreement, a works agreement or a service agreement (collective agreement).

Insofar as you have consented to the inclusion of your data in the applicant pool, your personal data will be deleted no later than twelve months after your data has been stored in the applicant pool or after receipt of your revocation, whichever is earlier.

8. Data subject rights

Under the General Data Protection Regulation, you have the following rights:

  • If your personal data is processed, you have the right to obtain information from the controller about the data stored about you (Art. 15 GDPR).
  • If incorrect personal data is processed, you have a right to rectification (Art. 16 GDPR).
  • If the legal requirements are met, you may request the erasure or restriction of processing (Art. 17 and 18 GDPR).
  • If you have consented to the data processing or if a contract for data processing exists and the data processing is carried out with the help of automated procedures, you may have a right to data portability (Art. 20 GDPR).
  • Furthermore, there is a right of appeal to a supervisory authority (Art. 77 GDPR). The supervisory authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. You can reach this under


The State Commissioner for Data Protection and
Freedom of Information Baden-Württemberg
Address: Lautenschlagerstrasse 20, 70173 Stuttgart
Postal address: P.O. Box 10 29 32, 70025 Stuttgart
Phone: 0711 / 615541-0


If the legal requirements are met, you may object at any time on grounds relating to your particular situation to the processing of personal data relating to you which is carried out on the basis of Article 6 (1) (e) or (f) GDPR (Article 21 GDPR).

Right of withdrawal for consent

If you have consented to the processing of your personal data by the controller, you may revoke your consent at any time for the future. The lawfulness of the data processing that took place until the revocation is not affected in this case.

We reserve the right to make changes to this privacy policy at any time. The privacy policy will be updated regularly and all changes will be published automatically on our website.